1. Field of the Invention
The invention relates in general to elevator systems, and more specifically to elevator systems which include a plurality of elevator cars under the control of a system processor.
2. Description of the Prior Art
When a building requires a more than one elevator car to serve the traffic, some sort of supervisory control means is usually provided in order to insure efficient elevator service. For example, in U.S. Pat. No. 2,695,077 which is assigned to the same assignee as the present invention, the elevator cars are dispatched successively from a dispatching floor by a main dispatching device. Failure of the main dispatching device would terminate all elevator service once all of the elevator cars have returned to the main dispatching floor. Thus, this patent discloses the use of an emergency dispatching device, in order to continue elevator service.
U.S. Pat. No. 3,854,554, which is assigned to the same assignee as the present application, discloses an improved supervisory system control arrangement for a plurality of elevator cars, in which the cars are controlled by inhibit or overriding signals, rather than by direct commands. The elevator cars each include a car controller which enables the associated elevator car to independently respond to a registered hall call. The supervisory system control decides which elevator car should answer a specific hall call and issues signals which inhibit the other elevator cars from responding to the call. Failure of the supervisory control in a mode in which inhibit signals are not sent to the cars does not terminate elevator service, and it does not require a standby emergency dispatcher, as all elevator cars are automatically on independent control in the absence of inhibit signals.
Failure of the supervisory control in a mode which may continuously provide inhibit signals, or otherwise adversely affect the ability of the elevator cars to operate properly, may be detected by monitoring a selected function of the supervisory control. For example, when the supervisory system control includes a digital computer with the operating strategy stored in the memory thereof in the form of a program, the stored program must be run repeatedly to continuously update the systems. U.S. Pat. No. 3,854,554 suggests a hardwired timing circuit, as opposed to a software timing circuit, whose output is held high by periodic accessing by the stored operating program. Failure of the supervisory control to access the timing circuit at the proper frequency allows it to time out and provide a low signal which is used to prevent signals provided by the supervisory control from being considered by the car controllers of the various elevator cars.
U.S. Pat. No. 4,046,227 which is assigned to the same assignee as the present application, discloses a dispatcher monitor 230 which determines if the dispatcher is preparing timely command words for the elevator cars.
U.S. Pat. No. 4,162,719 which is assigned to the same assignee as the present application, discloses a dispatcher monitor which starts a timer when any hall call is registered, and it resets the timer when any hall call is reset. If the timer times out, corrective action is taken.
While these prior art monitoring arrangements detect certain dispatcher malfunctions, it has been found that certain dispatcher malfunctions may go undetected. For example, a certain portion of a program of a programmable system processor may be accessed on a timely basis, but if no cars are being dispatched by the system processor, there will be no elevator service. Since the monitor is detecting only whether or not the system processor is accessing a certain portion of the program on a timely basis, the monitor will not detect this failure. In like manner, the system processor may be providing command words for the elevator cars in a timely manner, but the word content of the commands may be incorrect, again resulting in either no elevator service, or degraded elevator service. A monitor which only checks to see whether command words are being provided in a timely manner, would not detect the quality of the commands. Still further, hass calls may be registered and hall calls may be reset, with no guarantee that all calls are being answered. Thus, a dispatcher monitor which operates on this basis may allow failure to serve certain floors to go undetected.
These prior art dispatcher monitors do not take system operating conditions into consideration when determining whether or not the dispatcher has malfunctioned. During certain system operating conditions, a hall call from a certain floor may normally take a longer period of time to be serviced. Thus, a monitor which generally compares call registration with call reset may needlessly shut the dispatcher down, unless the timing period is set quite long. Setting the timing period long, however, results in a long period of time without elevator service when the dispatcher does malfunction.